Quantum State Verification

• Quantum State Verification is a process that certifies a quantum device’s output is close to an ideal state using randomized binary tests and fidelity bounds.
• It employs structured protocols such as local, LOCC, adaptive, and homogeneous strategies, with spectral gaps playing a critical role in efficiency and reliability.
• Advanced approaches extend QSV to adversarial, device-independent, and collective schemes, addressing non-IID behavior and composable security challenges.

Searching arXiv for recent and foundational QSV papers to ground the article. Quantum state verification (QSV) is the task of certifying that a quantum device or source prepares a target state that is sufficiently close to an intended ideal state, without reconstructing the full density matrix. In the standard formulation, a verifier applies randomized binary tests that accept the target state with certainty and infer, from the observed pass statistics, a fidelity guarantee such as $F(\rho,|\psi\rangle)\ge 1-\epsilon$ with confidence $1-\delta$. Across recent work, QSV has developed into a broad framework spanning local and LOCC protocols, homogeneous and adaptive strategies, adversarial and composable security models, device-independent verification, memory-assisted and collective schemes, and extensions to subspace verification, gate verification, and continuous-variable systems (Yu et al., 2021, Wiesner et al., 12 Dec 2025).

1. Formal definitions and statistical structure

For a pure target state $|\psi\rangle$, the basic figure of merit is the fidelity $F(\rho,|\psi\rangle)=\langle\psi|\rho|\psi\rangle$, with infidelity $\epsilon=1-F(\rho,|\psi\rangle)$. More generally, the Uhlmann fidelity is

$$F(\rho,\sigma)=\big(\mathrm{Tr}\sqrt{\sqrt{\rho}\sigma\sqrt{\rho}}\big)^2,$$

and is related to trace distance by the Fuchs–van de Graaf inequalities,

$$1-\sqrt{F(\rho,\sigma)}\le \tfrac{1}{2}\|\rho-\sigma\|_1\le \sqrt{1-F(\rho,\sigma)}.$$

These relations are central because many QSV guarantees are naturally stated either in fidelity or trace distance and must be translated between operational and composable formulations (Wiesner et al., 12 Dec 2025, Yu et al., 2021).

A QSV protocol is commonly specified by a verification operator

$\Omega=\sum_l p_l \Omega_l,$

where each $\Omega_l$ is a pass operator of a two-outcome test chosen with probability $p_l$, and $1-\delta$0 so that the target always passes. The pass probability for an arbitrary state $1-\delta$1 is

$1-\delta$2

If $1-\delta$3 is the second-largest eigenvalue, then the spectral gap

$1-\delta$4

governs efficiency: for any state with fidelity at most $1-\delta$5, the worst-case pass probability is $1-\delta$6, and $1-\delta$7 independent tests suffice when

$1-\delta$8

up to the standard small-$1-\delta$9 approximation (Li et al., 15 Jul 2025, Zhang et al., 2020, Yu et al., 2021).

This spectral-gap formalism underlies both verification and fidelity estimation. In homogeneous strategies, one has

$|\psi\rangle$0

so the pass frequency directly estimates fidelity through a linear inversion formula. This is one reason homogeneous constructions recur across discrete-variable, device-independent, and continuous-variable QSV (Liu et al., 2022, Wang et al., 19 Jun 2026).

QSV is naturally expressed as hypothesis testing. A typical formulation is

$|\psi\rangle$1

or, in finite-sample settings, a test on average fidelity over many runs. Tail bounds such as Hoeffding and Chernoff–Hoeffding, often in KL-divergence form, then yield explicit significance levels and stopping rules (Yu et al., 2021, Li et al., 15 Jul 2025, Li, 2024).

2. Local, LOCC, and homogeneous verification strategies

A major line of QSV research asks how much efficiency can be obtained using only local projective measurements. For two-qubit entangled targets, nonadaptive local protocols already achieve the optimal $|\psi\rangle$2 infidelity scaling up to a constant factor, while LOCC adaptivity improves that constant substantially. For the family

$|\psi\rangle$3

the optimal nonadaptive local strategy has constant factor $|\psi\rangle$4, whereas one-way LOCC gives $|\psi\rangle$5, and bi-directional one-step LOCC achieves $|\psi\rangle$6, independent of $|\psi\rangle$7 (Zhang et al., 2020). In the Bell-state case, the canonical local verification operator is

$|\psi\rangle$8

with spectral gap $|\psi\rangle$9 (Liu et al., 2022, Yu et al., 2021).

For multipartite structured states, several families admit efficient local or LOCC protocols. GHZ states can be verified by stabilizer-inspired measurements, including a two-setting protocol with $F(\rho,|\psi\rangle)=\langle\psi|\rho|\psi\rangle$0 and an optimal local/LOCC protocol with $F(\rho,|\psi\rangle)=\langle\psi|\rho|\psi\rangle$1 (Yu et al., 2021). Graph states admit coloring-based protocols, where the gap is $F(\rho,|\psi\rangle)=\langle\psi|\rho|\psi\rangle$2 or $F(\rho,|\psi\rangle)=\langle\psi|\rho|\psi\rangle$3, depending on graph coloring or fractional coloring, and can often be improved by local Clifford optimization (Yu et al., 2021). W and Dicke states are more demanding because they are nonstabilizer states, but one-way adaptive local strategies still yield efficient verification, and homogeneous variants have been developed for the three-qubit $F(\rho,|\psi\rangle)=\langle\psi|\rho|\psi\rangle$4 state (Li et al., 15 Jul 2025, Liu et al., 2022).

A systematic operator-first construction of homogeneous local protocols for arbitrary entangled pure states was proposed through “choice-independent measurement protocols.” In that framework, one starts from a target homogeneous operator

$F(\rho,|\psi\rangle)=\langle\psi|\rho|\psi\rangle$5

and asks whether it can be realized by local measurements through quasi-probability locality conditions. For Pauli projections on $F(\rho,|\psi\rangle)=\langle\psi|\rho|\psi\rangle$6 qubits, the resulting universal homogeneous-local framework has an $F(\rho,|\psi\rangle)=\langle\psi|\rho|\psi\rangle$7 upper bound on $F(\rho,|\psi\rangle)=\langle\psi|\rho|\psi\rangle$8, while still recovering optimal or near-optimal strategies for Bell, GHZ, and certain stabilizer states (Liu et al., 2022). This suggests that homogeneous operator design is broadly useful, but that unrestricted universality with local measurements carries an intrinsic exponential-in-$F(\rho,|\psi\rangle)=\langle\psi|\rho|\psi\rangle$9 price in the worst case.

A different universal direction uses Schmidt decomposition and mutually unbiased bases (MUBs). An adaptive Schmidt-decomposition protocol for arbitrary multipartite pure states guarantees

$\epsilon=1-F(\rho,|\psi\rangle)$0

independent of local dimensions. Simpler MUB-based variants, including correlated and symmetrized schemes with $\epsilon=1-F(\rho,|\psi\rangle)$1 or $\epsilon=1-F(\rho,|\psi\rangle)$2 test settings, empirically achieve constant spectral gaps for Haar-random pure states, implying $\epsilon=1-F(\rho,|\psi\rangle)$3 even in adversarial scenarios (Li et al., 24 Jun 2025). This suggests that universal verification of pure states may be practical for typical high-dimensional targets, even when worst-case guarantees remain more conservative.

3. Non-IID, adversarial, and composable security

A central distinction in modern QSV is between benign i.i.d. analysis and adversarial security. Standard QSV often assumes independent and identically distributed copies, so that pass/fail outcomes obey binomial statistics. In that regime, a homogeneous strategy with verification operator

$\epsilon=1-F(\rho,|\psi\rangle)$4

yields

$\epsilon=1-F(\rho,|\psi\rangle)$5

allowing exact binomial inversion of pass statistics to produce fidelity certificates (Zhang et al., 12 Jun 2025).

Without IID, however, these inferences can fail. Defensive QSV (DQSV) addresses this by having the source provide $\epsilon=1-F(\rho,|\psi\rangle)$6 systems, choosing $\epsilon=1-F(\rho,|\psi\rangle)$7 of them uniformly at random for testing, and certifying the remaining untested system conditioned on observing at most $\epsilon=1-F(\rho,|\psi\rangle)$8 failures. For permutation-invariant adversarial states $\epsilon=1-F(\rho,|\psi\rangle)$9, the protocol defines

$$F(\rho,\sigma)=\big(\mathrm{Tr}\sqrt{\sqrt{\rho}\sigma\sqrt{\rho}}\big)^2,$$0

$$F(\rho,\sigma)=\big(\mathrm{Tr}\sqrt{\sqrt{\rho}\sigma\sqrt{\rho}}\big)^2,$$1

and the conditional fidelity

$$F(\rho,\sigma)=\big(\mathrm{Tr}\sqrt{\sqrt{\rho}\sigma\sqrt{\rho}}\big)^2,$$2

The resulting guarantee $$F(\rho,\sigma)=\big(\mathrm{Tr}\sqrt{\sqrt{\rho}\sigma\sqrt{\rho}}\big)^2,$$3 is exact and tight for homogeneous strategies, requires no IID assumption, and remains experimentally efficient (Zhang et al., 12 Jun 2025).

Experiments on a two-qubit singlet showed that standard IID-based QSV certificates can be violated in correlated and maliciously modulated scenarios, whereas DQSV certificates remain valid and nearly tight. Under honest operation both SQSV and DQSV showed $$F(\rho,\sigma)=\big(\mathrm{Tr}\sqrt{\sqrt{\rho}\sigma\sqrt{\rho}}\big)^2,$$4, and with $$F(\rho,\sigma)=\big(\mathrm{Tr}\sqrt{\sqrt{\rho}\sigma\sqrt{\rho}}\big)^2,$$5 the DQSV protocol certified $$F(\rho,\sigma)=\big(\mathrm{Tr}\sqrt{\sqrt{\rho}\sigma\sqrt{\rho}}\big)^2,$$6 at $$F(\rho,\sigma)=\big(\mathrm{Tr}\sqrt{\sqrt{\rho}\sigma\sqrt{\rho}}\big)^2,$$7 confidence (Zhang et al., 12 Jun 2025). This establishes that adversarial robustness need not always destroy efficiency, provided the protocol departs from naïve IID inversion.

The strongest negative result concerns arbitrary-state cut-and-choose verification. In the canonical cut-and-choose paradigm, a source supplies $$F(\rho,\sigma)=\big(\mathrm{Tr}\sqrt{\sqrt{\rho}\sigma\sqrt{\rho}}\big)^2,$$8 registers, $$F(\rho,\sigma)=\big(\mathrm{Tr}\sqrt{\sqrt{\rho}\sigma\sqrt{\rho}}\big)^2,$$9 are tested, and one untested register is output if the test passes. For stand-alone fidelity-based security, if the protocol is $$1-\sqrt{F(\rho,\sigma)}\le \tfrac{1}{2}\|\rho-\sigma\|_1\le \sqrt{1-F(\rho,\sigma)}.$$0-correct and $$1-\sqrt{F(\rho,\sigma)}\le \tfrac{1}{2}\|\rho-\sigma\|_1\le \sqrt{1-F(\rho,\sigma)}.$$1-secure, then

$$1-\sqrt{F(\rho,\sigma)}\le \tfrac{1}{2}\|\rho-\sigma\|_1\le \sqrt{1-F(\rho,\sigma)}.$$2

For composable security expressed via trace distance against an ideal functionality $$1-\sqrt{F(\rho,\sigma)}\le \tfrac{1}{2}\|\rho-\sigma\|_1\le \sqrt{1-F(\rho,\sigma)}.$$3, the trade-off is

$$1-\sqrt{F(\rho,\sigma)}\le \tfrac{1}{2}\|\rho-\sigma\|_1\le \sqrt{1-F(\rho,\sigma)}.$$4

where $$1-\sqrt{F(\rho,\sigma)}\le \tfrac{1}{2}\|\rho-\sigma\|_1\le \sqrt{1-F(\rho,\sigma)}.$$5 is the largest eigenvalue of the target state $$1-\sqrt{F(\rho,\sigma)}\le \tfrac{1}{2}\|\rho-\sigma\|_1\le \sqrt{1-F(\rho,\sigma)}.$$6; for pure $$1-\sqrt{F(\rho,\sigma)}\le \tfrac{1}{2}\|\rho-\sigma\|_1\le \sqrt{1-F(\rho,\sigma)}.$$7,

$$1-\sqrt{F(\rho,\sigma)}\le \tfrac{1}{2}\|\rho-\sigma\|_1\le \sqrt{1-F(\rho,\sigma)}.$$8

These bounds hold even for arbitrary coherent joint tests on the $$1-\sqrt{F(\rho,\sigma)}\le \tfrac{1}{2}\|\rho-\sigma\|_1\le \sqrt{1-F(\rho,\sigma)}.$$9 tested systems, randomized output positions, and randomized numbers of rounds, and already arise against i.i.d. attacks (Wiesner et al., 12 Dec 2025).

The mechanism is the inability of acceptance statistics on tested blocks to constrain the untested output strongly enough. If the dishonest source sends $\Omega=\sum_l p_l \Omega_l,$0 instead of $\Omega=\sum_l p_l \Omega_l,$1, then the honest and dishonest acceptance probabilities satisfy

$\Omega=\sum_l p_l \Omega_l,$2

so the product overlap can keep acceptance high while leaving the output non-negligibly distinguishable from $\Omega=\sum_l p_l \Omega_l,$3 (Wiesner et al., 12 Dec 2025). The practical implication is that generic cut-and-choose QSV for arbitrary states is effectively unusable as an efficient composable black-box primitive.

4. Device-independent, semi-device-independent, and untrusted-network verification

Device-independent QSV replaces trusted measurements by black boxes and formulates guarantees in terms of extractability rather than direct fidelity. For a physical state $\Omega=\sum_l p_l \Omega_l,$4 and target pure state $\Omega=\sum_l p_l \Omega_l,$5, the extractability is

$\Omega=\sum_l p_l \Omega_l,$6

maximized over local isometries. Robust self-testing then provides linear relations between nonlocal-game winning probability and extractability deficits (Gočanin et al., 2021).

In the finite-copy, non-IID regime, device-independent verification can be performed by conditioning on the actual measurement history. Writing $\Omega=\sum_l p_l \Omega_l,$7 for the conditional state in round $\Omega=\sum_l p_l \Omega_l,$8, one defines

$\Omega=\sum_l p_l \Omega_l,$9

For algebraic-bound self-tests, the number of copies required scales optimally as

$\Omega_l$0

where $\Omega_l$1 is the robust self-testing constant. For nonalgebraic quantum bounds, the scaling becomes

$\Omega_l$2

This yields optimal finite-copy DI verification in the algebraic-bound case and extends to certification of unmeasured copies when only a random fraction is tested (Gočanin et al., 2021).

A semi-device-independent route considers untrusted quantum networks in which one or more parties are honest and perform trusted local projective measurements while other parties may be adversarial. For Bell-state verification in such a setting, each protocol corresponds to a probability distribution $\Omega_l$3 over Bloch-sphere directions. The average cheating acceptance is governed by

$\Omega_l$4

with

$\Omega_l$5

where $\Omega_l$6 is concurrence. For separable states,

$\Omega_l$7

The isotropic protocol, with $\Omega_l$8 uniform over the sphere, minimizes the separable threshold and gives $\Omega_l$9, hence an effective gap $p_l$0, which is close to optimal trusted LOCC QSV (Han et al., 2021).

The same geometric framework extends to GHZ states in untrusted networks. Compatible local tests are either all $p_l$1-basis measurements or equatorial measurements with phases summing to zero modulo $p_l$2. The optimal GHZ protocol becomes an equator-plus-$p_l$3 distribution with threshold

$p_l$4

yielding sample complexity approximately $p_l$5, again close to the trusted-device optimum (Han et al., 2021). These SDI constructions sit between device-dependent and fully DI schemes, sacrificing some generality while retaining strong security and practical measurement simplicity.

5. Collective, memory-assisted, and sequence-optimized verification

Single-copy QSV treats each copy independently, but several works show that storing or collectively preprocessing multiple copies can drastically improve efficiency or resource consumption. In quantum-memory-assisted QSV, the verifier stores $p_l$6 copies locally and performs collective measurements across those local memories, while still using only local operations across parties. For the two-copy case, a general theory introduces

$p_l$7

where $p_l$8 and $p_l$9, and shows that if $1-\delta$00 and an insurance-infidelity condition holds, then

$1-\delta$01

so the total number of copies behaves as

$1-\delta$02

For graph states, a two-copy strategy based solely on local Bell measurements attains $1-\delta$03, giving the globally optimal scaling $1-\delta$04 with a single global measurement setting (Chen et al., 2023).

With arbitrarily many stored copies, a dimension-expansion technique treats $1-\delta$05 local copies as one effective $1-\delta$06-dimensional system. For GHZ-like states, this yields

$1-\delta$07

which decreases monotonically with $1-\delta$08 and approaches the global optimum $1-\delta$09 as $1-\delta$10 (Chen et al., 2023). This suggests that local quantum memory can asymptotically close the gap between local and global verification without requiring entangling measurements across parties.

Collective local preprocessing can also reduce the number of resource states that must be destroyed. For ensembles of Bell pairs, bilateral counter gates can transfer error information from many copies into a small auxiliary register. Measuring only the auxiliary then certifies the remaining pairs directly, yielding exponential savings over the best sequential single-copy verification protocols (Miguel-Ramiro et al., 2022). A plausible implication is that collective locality, when paired with structured promises on the noise model, can fundamentally alter the consumption-verification trade-off.

Another orthogonal line concerns the order of measurements rather than their structure. When only a fixed informationally complete library of measurements is available, sequential stopping based on compatible-state sets can make measurement order critical. The framework defines

$1-\delta$11

where $1-\delta$12 is the set compatible with data observed so far. One rejects if $1-\delta$13, accepts if $1-\delta$14, and otherwise continues. Greedy offline and adaptive strategies for ordering measurements substantially reduce the number of measurements required relative to random orderings, particularly in faulty preparations (Liang et al., 2023). This is not a replacement for spectral-gap QSV, but it addresses a realistic regime where measurement libraries are fixed and full target-specific tailoring is unavailable.

6. Extensions: subspaces, channels, measurements, bosonic systems, and dualities

QSV has broadened well beyond pure-state verification. Quantum subspace verification replaces a one-dimensional target projector by a subspace projector $1-\delta$15, with efficiency quantified by

$1-\delta$16

This quantity satisfies a minimax identity

$1-\delta$17

linking QSV directly to restricted-measurement distinguishability (Akibue et al., 1 Sep 2025). The same work establishes a duality with quantum data hiding: states that are hardest to verify under a measurement class are exactly those that are best for data hiding under that class.

Channel verification can be reduced to state verification via the Choi–Jamiołkowski isomorphism. For a unitary target $1-\delta$18, the ideal Choi state $1-\delta$19 can be verified either in an ancilla-assisted way or converted to a prepare-and-measure scheme using one-way LOCC verification operators, preserving the same efficiency bound in terms of the spectral gap (Yu et al., 2021).

Quantum measurement verification (QMV) has recently been reduced, under symmetry assumptions, to homogeneous QSV of a single basis state. For locally transitive and irreducible projective measurements, the representative verification operator takes the homogeneous form

$1-\delta$20

and the worst-case pass probability is again $1-\delta$21. Explicit local QMV protocols have been obtained for generalized Bell measurements, elegant joint measurements, and stabilizer-induced measurements, directly transporting spectral-gap optimization from QSV into measurement certification (Wang et al., 19 Jun 2026).

Continuous-variable QSV introduces different measurement models and witness constructions. In bosonic systems, fidelity witnesses of the form

$1-\delta$22

satisfy

$1-\delta$23

so larger $1-\delta$24 gives a more robust lower bound at the price of higher estimation cost (Upreti et al., 2024). Combined with measurement back-propagation for homodyne and heterodyne detection, this yields efficient semi-device-independent QSV for broad classes of Gaussian and non-Gaussian bosonic targets (Upreti et al., 2024).

Finally, shadows-based protocols aim at target-generic verification without intricate protocol design per state family. A recent directly partial shadow overlap protocol constructs a strategy operator $1-\delta$25 from conditional reduced states and uses a bounded estimator $1-\delta$26 with

$1-\delta$27

leading to the sample bound

$1-\delta$28

For GHZ states, careful equivalence-class averaging over partial Pauli measurements yields

$1-\delta$29

which is dramatically better than naïve uniform sampling (Li, 2024). This suggests that classical-shadow QSV becomes especially natural when combined with target symmetries rather than used as a completely structure-agnostic black box.

7. Applications, limitations, and current fault lines

QSV is now embedded in a wide range of tasks: anonymous conference key agreement, blind quantum computation, networked sensing, delegated and measurement-based computation, quantum computational supremacy demonstrations, gate certification, and distributed entanglement validation (Wiesner et al., 12 Dec 2025, Takeuchi et al., 2017). Its appeal is consistent: certify the property actually needed, rather than reconstruct the full state.

Several application-specific lessons recur. In many-qubit verification under restricted measurement capability, sequential single-qubit Pauli measurements can verify ground states of local Hamiltonians, generalized stabilizer states, and polynomial-time-generated hypergraph states without IID assumptions, using de Finetti reductions and Hoeffding bounds (Takeuchi et al., 2017). In the quantum linear systems problem, however, verifying closeness to the normalized solution state is itself costly: any QSV procedure requires $1-\delta$30 uses of the state-preparation oracle in the worst case and $1-\delta$31 for typical instances, while prepare-and-measure verification is quadratically worse (Somma et al., 2020). This underscores that QSV is not automatically cheap simply because full tomography is expensive.

A major present fault line is between efficient verification of structured states and impossibility for arbitrary-state black-box cryptographic subroutines. Specialized structure—stabilizer, graph, GHZ, Dicke, symmetric subspaces, Gaussian circuits—often yields efficient, even optimal, protocols (Yu et al., 2021, Chen et al., 2023, Upreti et al., 2024). By contrast, arbitrary-state cut-and-choose verification faces no-go trade-offs under composable security (Wiesner et al., 12 Dec 2025). This is not a contradiction: the positive results exploit symmetries, algebraic structure, or stronger assumptions that the no-go theorem explicitly does not grant.

Another recurring misunderstanding is to equate any finite-sample fidelity certificate with adversarial security. IID-based QSV, even when statistically rigorous, can produce false assurances under correlated or malicious behavior unless the protocol itself is designed for that regime (Zhang et al., 12 Jun 2025). Conversely, non-IID or composable security does not automatically force inefficiency in all models; it specifically constrains certain paradigms, especially cut-and-choose for arbitrary states (Wiesner et al., 12 Dec 2025).

A plausible synthesis is that QSV is best understood not as a single protocol family but as a hierarchy of certification paradigms. At one end lie highly tailored structured-state protocols with strong efficiency constants. In the middle lie generic but still physically grounded methods such as shadows, MUB-based universal pure-state verification, and semi-device-independent network tests. At the other end lie adversarially composable tasks, where protocol design must reckon with strong impossibility results unless additional structure, trust, or non-modular proof techniques are introduced.

For current research, several open directions remain explicit in the literature: optimizing universal local pure-state verification beyond current MUB constructions; integrating SPAM and non-IID robustness into shadows-based QSV; characterizing extremal states and subspaces under realistic measurement restrictions; designing efficient mixed-state and code-space verification; and finding composable alternatives to cut-and-choose that remain practical for cryptographic-scale deployments (Li et al., 24 Jun 2025, Li, 2024, Akibue et al., 1 Sep 2025, Wiesner et al., 12 Dec 2025). These directions suggest that QSV has matured from a collection of ad hoc tests into a general theory of operational certification, but that its most consequential future advances will likely come from matching verification paradigms tightly to physical structure and security requirements rather than seeking a single universal solution.